logoWordPressPluginsThemesAPISubmitContact
search-icon
logo
search-icon
WordPressPluginsThemesAPISubmitContactSecurity Scanner
Register

WordPress 3.0-4.8.1 - Path Traversal in Unzipping

Description

A path traversal vulnerability was discovered in the file unzipping code.

Affects WordPresses

3.8.1

Fixed in version 3.8.22✓

3.8

Fixed in version 3.8.22✓

3.7.1

Fixed in version 3.7.22✓

3.6

Fixed in version 4.8.2✓

3.5.2

Fixed in version 4.8.2✓

3.5.1

Fixed in version 4.8.2✓

3.5

Fixed in version 4.8.2✓

3.4.2

Fixed in version 4.8.2✓

3.4.1

Fixed in version 4.8.2✓

3.4

Fixed in version 4.8.2✓

References

CVE

CVE-2017-14719

URL

https://wordpress.org/news/2017/09/wordpress-4-8-2-security-and-maintenance-release/

URL

https://core.trac.wordpress.org/changeset/41457

URL

https://hackerone.com/reports/205481

Classification

Type

LFI

OWASP top 10

A1: Injection

CWE

CWE-22

Miscellaneous

Original Researcher

Alex Chapman (noxrnet)

Submitter

alykode

Verified

No

WPVDB ID

d74ee25a-d845-46b5-afa6-b0a917b7737a

Timeline

Publicly Published

2017-09-20 (about 3 years ago)

Added

2017-09-25 (about 3 years ago)

Last Updated

2020-09-22 (about 10 months ago)

Our Other Services

WPScan WordPress Security Plugin